polyrun[.]xyz

The domain polyrun.xyz is a confirmed phishing site engaged in brand impersonation targeting Robinhood, a financial services platform. It presented itself as a 'Security Check' page under the Robinhood.com name to harvest user credentials, posing an elevated risk of account takeover. As of the latest verification, polyrun.xyz has been taken offline, though it previously operated without an associated crypto drainer kit.

Technical indicators confirm the malicious nature of polyrun.xyz. The domain was flagged by 1 of 95 VirusTotal security vendors, specifically Forcepoint ThreatSeeker, and appeared on 2 security blocklists: PhishDestroy and ScamSniffer. Registered through OwnRegistrar, Inc. on March 14, 2026, it resolved to the IP address 104.21.20.58, hosted by Cloudflare in California. The SSL certificate was issued by Let's Encrypt (E7), and the site employed Cloudflare Browser Insights and HTTP/3 technologies. The observed page title was 'Security Check | Robinhood.com', reinforcing its impersonation of the legitimate Robinhood platform. Gridinsoft assigned a trust score of 0/100 to the domain.

Users who interacted with polyrun.xyz should immediately change their Robinhood account passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor the account for suspicious transactions or login attempts and report any fraudulent activity to Robinhood's support team. Additionally, victims can report the phishing domain to Google Safe Browsing, the Anti-Phishing Working Group (APWG), and their local cybercrime authorities to aid in takedown efforts.